Splunk Search

inputlookup excluding index

jmo1
Path Finder

 I am trying to write a query that will ignore events in certain indexes (these indexes change over time).  I have a CSV file with a single column that looks like this...

Index

a

b

c

   NOTE: this is a simple example, it really has 25+ indexes

 

 

 

host=* NOT index=[| inputlookup Index.csv | fields Index]

 

 

  This is my non-working attempt.  The actual query is irrelevant (host=*), the point is that I want to ignore any hits where the index is in the CSV file (index!=a index!=b index!=c).

 

Any help would be greatly appreciated.

 

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You don't need the index=... and case is important, so use this

host=* NOT [ | inputlookup indexes.csv | rename Index as index ]

Note the rename, as your column is Index, not index, so either change the column name in the table and just use | table index or go with the above

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You don't need the index=... and case is important, so use this

host=* NOT [ | inputlookup indexes.csv | rename Index as index ]

Note the rename, as your column is Index, not index, so either change the column name in the table and just use | table index or go with the above

 

0 Karma

jmo1
Path Finder

Thank you!  It is working.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...